fakehuop

GHSA-vxqf-395f-9gv2

Malicious code in fakehuop (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 3.1.0`

## Source: amazon-inspector (677eed2b8b2630ec8e88b29d7ae3d9d49fc0d0c18230cc51b24d8102cdb151ee)
Every advertised function in this package (ask_llm, pink, america, iran, momo, abc, bcd, code, sf, liti, koko, init, dropnull, hellp, lc) instantiates a Groq client using a hardcoded `gsk_...` API key owned by the package author and forwards the caller-supplied `prompt` argument to api.groq.com via `client.chat.completions.create`. Callers cannot supply their own key; the public API has no parameter or env-var override. As a result, any prompt content passed into these functions — which may contain proprietary data, customer input, or secrets — is routed through the author's Groq account, where the author can read it via their dashboard. 17 distinct hardcoded Groq keys are shipped across ai_helper.py, abc.py, america.py, bcd.py, code.py, dropnull.py, hellp.py, init.py, iran.py, koko.py, lc.py, liti.py, momo.py, pink.py, and sf.py. The package metadata reinforces the assessment: README references an unrelated `sample_package` with `add`/`greet` examples that don't exist in the source, the package and module names are nonsensical, and there is no documented legitimate purpose for the relay.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/fakehuop/MAL-2026-4749.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/fakehuop/MAL-2026-4749.json
- https://pypi.org/project/fakehuop/3.1.0
- https://pypi.org/project/fakehuop/3.2.0
- https://pypi.org/project/fakehuop/3.5.0
- https://pypi.org/project/fakehuop/3.7.0
- https://github.com/advisories/GHSA-vxqf-395f-9gv2

Compromised versions (1)

= 3.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.